hd/cfg
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

simplify var

Browse source
This commit is contained in:
Henri Dohmen 2026-04-04 14:47:10 +02:00
parent d54e653a2b
commit be2326ded0
8 changed files with 142 additions and 155 deletions
Download patch file Download diff file Expand all files Collapse all files

17
secrets.nix
View file

@ -1,9 +1,10 @@
let
pkgs = import <nixpkgs> { };
inherit (pkgs) lib;
ssh-keys = (import ./var { inherit lib; }).ssh-keys;
var = import ./var { inherit lib; };
ssh-keys = var.ssh-keys;
keys = ssh-keys.root;
trusted-keys = ssh-keys.trusted-root;
trusted-keys = ssh-keys.desktops.root;
secrets = [
"hd-password"
"roam/firefox-sync-secret"
@ -17,16 +18,14 @@ let
# Can only be decrypted by clients
"syncthing-password"
];
mkSecrets =
keys: secrets: lib.mergeAttrsList (map (x: { "secrets/${x}.age".publicKeys = keys; }) secrets);
syncthingManagedClients = (lib.importJSON ./var/syncthing-managed-clients.json).managed_clients;
mkSecrets = k: s: lib.mergeAttrsList (map (x: { "secrets/${x}.age".publicKeys = k; }) s);
mkSyncthingSecret = client: {
"secrets/syncthing/${client}.age".publicKeys = [ ssh-keys.by-host.root.${client} ];
};
syncthingSecrets = lib.mergeAttrsList (map mkSyncthingSecret syncthingManagedClients);
syncthingSecrets = lib.mergeAttrsList (map mkSyncthingSecret (lib.attrNames var.syncthing.managed));
in
lib.mergeAttrsList ([
lib.mergeAttrsList [
(mkSecrets keys secrets)
(mkSecrets trusted-keys trusted-secrets)
(syncthingSecrets)
])
syncthingSecrets
]